Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe
-
Size
520KB
-
MD5
2f1ba7e4159a2d5804160a6cb34679c1
-
SHA1
74049f50c69cbf04f026089522315bf645935b63
-
SHA256
e754d873bb134bd718bb32f78ab9e33f5892f7709b716a45315b44642cf88331
-
SHA512
7c4320fb53c947505a75170ee97d7185050a65086e305c8232fad9d38387bd8dc7c0d7d6f0ab95cfd37dbdafd5c3a45f2d4f7447abb31f585cc6ec0c7af02b6e
-
SSDEEP
12288:gj8fuxR21t5i8fHD/FQvwP1ZTofDKWWNZ:gj8fuK1GYHD/FYwAMN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1996 E0AE.tmp 3020 E11C.tmp 2712 E1A8.tmp 2816 E225.tmp 2108 E2B1.tmp 2944 E32E.tmp 2844 E3BA.tmp 1680 E447.tmp 2776 E4C4.tmp 2668 E531.tmp 3032 E5AE.tmp 2212 E61B.tmp 2260 E698.tmp 2072 E705.tmp 2520 E782.tmp 1504 E80E.tmp 1556 E88B.tmp 2908 E917.tmp 792 E994.tmp 316 EA11.tmp 2964 EA8E.tmp 1524 EAFB.tmp 1332 EB68.tmp 2040 EBB6.tmp 1768 EC04.tmp 2176 EC42.tmp 2164 EC81.tmp 2220 ECCF.tmp 1696 ED0D.tmp 2240 ED4C.tmp 2436 ED8A.tmp 1764 EDC8.tmp 780 EE16.tmp 1920 EE55.tmp 2112 EE93.tmp 684 EEE1.tmp 2020 EF20.tmp 2400 EF5E.tmp 1340 EFAC.tmp 2432 EFEA.tmp 1860 F038.tmp 2472 F077.tmp 1004 F0B5.tmp 1784 F0F4.tmp 2508 F142.tmp 1736 F180.tmp 3056 F1BE.tmp 2328 F20C.tmp 1848 F25A.tmp 2116 F299.tmp 2144 F2E7.tmp 2344 F335.tmp 1600 F383.tmp 2580 F3D1.tmp 704 F41F.tmp 2744 F46D.tmp 2200 F4BB.tmp 2100 F4F9.tmp 2848 F538.tmp 2756 F586.tmp 2948 F5D4.tmp 2884 F612.tmp 2832 F660.tmp 2800 F69E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2548 2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe 1996 E0AE.tmp 3020 E11C.tmp 2712 E1A8.tmp 2816 E225.tmp 2108 E2B1.tmp 2944 E32E.tmp 2844 E3BA.tmp 1680 E447.tmp 2776 E4C4.tmp 2668 E531.tmp 3032 E5AE.tmp 2212 E61B.tmp 2260 E698.tmp 2072 E705.tmp 2520 E782.tmp 1504 E80E.tmp 1556 E88B.tmp 2908 E917.tmp 792 E994.tmp 316 EA11.tmp 2964 EA8E.tmp 1524 EAFB.tmp 1332 EB68.tmp 2040 EBB6.tmp 1768 EC04.tmp 2176 EC42.tmp 2164 EC81.tmp 2220 ECCF.tmp 1696 ED0D.tmp 2240 ED4C.tmp 2436 ED8A.tmp 1764 EDC8.tmp 780 EE16.tmp 1920 EE55.tmp 2112 EE93.tmp 684 EEE1.tmp 2020 EF20.tmp 2400 EF5E.tmp 1340 EFAC.tmp 2432 EFEA.tmp 1860 F038.tmp 2472 F077.tmp 1004 F0B5.tmp 1784 F0F4.tmp 2508 F142.tmp 1736 F180.tmp 3056 F1BE.tmp 2328 F20C.tmp 1848 F25A.tmp 2116 F299.tmp 2144 F2E7.tmp 2344 F335.tmp 1600 F383.tmp 2580 F3D1.tmp 704 F41F.tmp 2744 F46D.tmp 2200 F4BB.tmp 2100 F4F9.tmp 2848 F538.tmp 2756 F586.tmp 2948 F5D4.tmp 2884 F612.tmp 2832 F660.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C533.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 751.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 1996 2548 2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe 29 PID 2548 wrote to memory of 1996 2548 2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe 29 PID 2548 wrote to memory of 1996 2548 2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe 29 PID 2548 wrote to memory of 1996 2548 2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe 29 PID 1996 wrote to memory of 3020 1996 E0AE.tmp 30 PID 1996 wrote to memory of 3020 1996 E0AE.tmp 30 PID 1996 wrote to memory of 3020 1996 E0AE.tmp 30 PID 1996 wrote to memory of 3020 1996 E0AE.tmp 30 PID 3020 wrote to memory of 2712 3020 E11C.tmp 31 PID 3020 wrote to memory of 2712 3020 E11C.tmp 31 PID 3020 wrote to memory of 2712 3020 E11C.tmp 31 PID 3020 wrote to memory of 2712 3020 E11C.tmp 31 PID 2712 wrote to memory of 2816 2712 E1A8.tmp 32 PID 2712 wrote to memory of 2816 2712 E1A8.tmp 32 PID 2712 wrote to memory of 2816 2712 E1A8.tmp 32 PID 2712 wrote to memory of 2816 2712 E1A8.tmp 32 PID 2816 wrote to memory of 2108 2816 E225.tmp 33 PID 2816 wrote to memory of 2108 2816 E225.tmp 33 PID 2816 wrote to memory of 2108 2816 E225.tmp 33 PID 2816 wrote to memory of 2108 2816 E225.tmp 33 PID 2108 wrote to memory of 2944 2108 E2B1.tmp 34 PID 2108 wrote to memory of 2944 2108 E2B1.tmp 34 PID 2108 wrote to memory of 2944 2108 E2B1.tmp 34 PID 2108 wrote to memory of 2944 2108 E2B1.tmp 34 PID 2944 wrote to memory of 2844 2944 E32E.tmp 35 PID 2944 wrote to memory of 2844 2944 E32E.tmp 35 PID 2944 wrote to memory of 2844 2944 E32E.tmp 35 PID 2944 wrote to memory of 2844 2944 E32E.tmp 35 PID 2844 wrote to memory of 1680 2844 E3BA.tmp 36 PID 2844 wrote to memory of 1680 2844 E3BA.tmp 36 PID 2844 wrote to memory of 1680 2844 E3BA.tmp 36 PID 2844 wrote to memory of 1680 2844 E3BA.tmp 36 PID 1680 wrote to memory of 2776 1680 E447.tmp 37 PID 1680 wrote to memory of 2776 1680 E447.tmp 37 PID 1680 wrote to memory of 2776 1680 E447.tmp 37 PID 1680 wrote to memory of 2776 1680 E447.tmp 37 PID 2776 wrote to memory of 2668 2776 E4C4.tmp 38 PID 2776 wrote to memory of 2668 2776 E4C4.tmp 38 PID 2776 wrote to memory of 2668 2776 E4C4.tmp 38 PID 2776 wrote to memory of 2668 2776 E4C4.tmp 38 PID 2668 wrote to memory of 3032 2668 E531.tmp 39 PID 2668 wrote to memory of 3032 2668 E531.tmp 39 PID 2668 wrote to memory of 3032 2668 E531.tmp 39 PID 2668 wrote to memory of 3032 2668 E531.tmp 39 PID 3032 wrote to memory of 2212 3032 E5AE.tmp 40 PID 3032 wrote to memory of 2212 3032 E5AE.tmp 40 PID 3032 wrote to memory of 2212 3032 E5AE.tmp 40 PID 3032 wrote to memory of 2212 3032 E5AE.tmp 40 PID 2212 wrote to memory of 2260 2212 E61B.tmp 41 PID 2212 wrote to memory of 2260 2212 E61B.tmp 41 PID 2212 wrote to memory of 2260 2212 E61B.tmp 41 PID 2212 wrote to memory of 2260 2212 E61B.tmp 41 PID 2260 wrote to memory of 2072 2260 E698.tmp 42 PID 2260 wrote to memory of 2072 2260 E698.tmp 42 PID 2260 wrote to memory of 2072 2260 E698.tmp 42 PID 2260 wrote to memory of 2072 2260 E698.tmp 42 PID 2072 wrote to memory of 2520 2072 E705.tmp 43 PID 2072 wrote to memory of 2520 2072 E705.tmp 43 PID 2072 wrote to memory of 2520 2072 E705.tmp 43 PID 2072 wrote to memory of 2520 2072 E705.tmp 43 PID 2520 wrote to memory of 1504 2520 E782.tmp 44 PID 2520 wrote to memory of 1504 2520 E782.tmp 44 PID 2520 wrote to memory of 1504 2520 E782.tmp 44 PID 2520 wrote to memory of 1504 2520 E782.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_2f1ba7e4159a2d5804160a6cb34679c1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\E698.tmp"C:\Users\Admin\AppData\Local\Temp\E698.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\E705.tmp"C:\Users\Admin\AppData\Local\Temp\E705.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\EE16.tmp"C:\Users\Admin\AppData\Local\Temp\EE16.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:684 -
C:\Users\Admin\AppData\Local\Temp\EF20.tmp"C:\Users\Admin\AppData\Local\Temp\EF20.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"C:\Users\Admin\AppData\Local\Temp\EF5E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F038.tmp"C:\Users\Admin\AppData\Local\Temp\F038.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\F299.tmp"C:\Users\Admin\AppData\Local\Temp\F299.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\F612.tmp"C:\Users\Admin\AppData\Local\Temp\F612.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F69E.tmp"C:\Users\Admin\AppData\Local\Temp\F69E.tmp"65⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"66⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"67⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"68⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"69⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"70⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"71⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"72⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"73⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"74⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"75⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"76⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"77⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"78⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"79⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"C:\Users\Admin\AppData\Local\Temp\FAA4.tmp"80⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"81⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"82⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"83⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"84⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"85⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"86⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"87⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"88⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"89⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\FD43.tmp"C:\Users\Admin\AppData\Local\Temp\FD43.tmp"90⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"91⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"92⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"93⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"94⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"95⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"96⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"97⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"98⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"99⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"100⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"101⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"102⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"103⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"104⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"105⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\187.tmp"C:\Users\Admin\AppData\Local\Temp\187.tmp"106⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"107⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"108⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\261.tmp"C:\Users\Admin\AppData\Local\Temp\261.tmp"109⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2A0.tmp"C:\Users\Admin\AppData\Local\Temp\2A0.tmp"110⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"111⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"112⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\35B.tmp"C:\Users\Admin\AppData\Local\Temp\35B.tmp"113⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"114⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3D8.tmp"C:\Users\Admin\AppData\Local\Temp\3D8.tmp"115⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\426.tmp"C:\Users\Admin\AppData\Local\Temp\426.tmp"116⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\464.tmp"C:\Users\Admin\AppData\Local\Temp\464.tmp"117⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"118⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4E1.tmp"C:\Users\Admin\AppData\Local\Temp\4E1.tmp"119⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\51F.tmp"C:\Users\Admin\AppData\Local\Temp\51F.tmp"120⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"121⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\59C.tmp"C:\Users\Admin\AppData\Local\Temp\59C.tmp"122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-